id: d35057ff89894f4684c192884ca73c67
parent_id: eb1408c004e947c59dddf5225f3b0d6d
item_type: 1
item_id: 1fbaa70f2fb94ffcaabbeca7b39482da
item_updated_time: 1787291600240
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\"KDF/` (1\"],[-1,\"3\"],[1,\"2 sets), `Transport/` (2\"],[0,\" sets) a\"]],\"start1\":153,\"start2\":153,\"length1\":17,\"length2\":40},{\"diffs\":[[0,\"Backup/`\"],[1,\"\\\n>\"],[0,\" (5 sets\"]],\"start1\":201,\"start2\":201,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\".puml` +\"],[-1,\"\\\n>\"],[0,\" rendere\"]],\"start1\":231,\"start2\":231,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"not this\"],[1,\"\\\n>\"],[0,\" note. P\"]],\"start1\":282,\"start2\":282,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\" use the\"],[-1,\"\\\n>\"],[0,\" **SVG**\"]],\"start1\":314,\"start2\":314,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"low 1**,\"],[1,\"\\\n>\"],[0,\" **Keyfo\"]],\"start1\":354,\"start2\":354,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\"on (\"],[-1,\"added 2026-08-21\"],[1,\"Transport/, 2026-08-21, split into two slides same day\"],[0,\")** —\"],[1,\"\\\n>  \"],[0,\" sta\"]],\"start1\":907,\"start2\":907,\"length1\":29,\"length2\":71},{\"diffs\":[[0,\"rity\"],[-1,\":\\\n>  \"],[1,\", split for slide use:\\\n>   **1/2**\"],[0,\" mTL\"]],\"start1\":1003,\"start2\":1003,\"length1\":13,\"length2\":42},{\"diffs\":[[0,\"chain to\"],[1,\"\\\n>  \"],[0,\" Clypeum\"]],\"start1\":1099,\"start2\":1099,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\"eum Root\"],[-1,\"\\\n>  \"],[0,\" CA + ho\"]],\"start1\":1116,\"start2\":1116,\"length1\":20,\"length2\":16},{\"diffs\":[[0,\"ver)\"],[-1,\", accept_invalid_certs dev caveat (C1),\\\n>   OAuth2 public-client token (empty user/pass BY DESIGN — mTLS is the auth),\\\n>  \"],[1,\" + OAuth2 bearer token;\\\n>   **2/2**\"],[0,\" see\"]],\"start1\":1162,\"start2\":1162,\"length1\":130,\"length2\":43},{\"diffs\":[[0,\"ted)\"],[-1,\", and\"],[1,\" +\"],[0,\" AES\"]],\"start1\":1286,\"start2\":1286,\"length1\":13,\"length2\":10},{\"diffs\":[[0,\"cryption\"],[-1,\".\\\n>  \"],[1,\" with\\\n>   the double-protection note.\"],[0,\" Verifie\"]],\"start1\":1342,\"start2\":1342,\"length1\":21,\"length2\":53},{\"diffs\":[[0,\"ent.rs +\"],[1,\"\\\n>  \"],[0,\" contain\"]],\"start1\":1413,\"start2\":1413,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\"rser.rs.\"],[1,\" (Removed on request: the accept_invalid_certs note, the\\\n>   validation-failure alt box, and the empty-user/password note.)\"],[0,\"\\\n> - **H\"]],\"start1\":1438,\"start2\":1438,\"length1\":16,\"length2\":139},{\"diffs\":[[0,\" - All 1\"],[-1,\"8\"],[1,\"9\"],[0,\" diagram\"]],\"start1\":2604,\"start2\":2604,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"/KDF/ (1\"],[-1,\"3\"],[1,\"2\"],[0,\" sets)\\\n\\\n\"]],\"start1\":2676,\"start2\":2676,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"p |\\\n\"],[-1,\"| `klms-connection` | Station↔KLMS connection: mTLS + cert validation, token, seed→wrapper key, AES-256-CBC container transport |\\\n\"],[0,\"| `f\"]],\"start1\":3107,\"start2\":3107,\"length1\":138,\"length2\":8},{\"diffs\":[[0,\"des) |\\\n\\\n\"],[1,\"### docs/diagrams/Transport/ (2 sets)\\\n\\\n| File | Shows |\\\n| --- | --- |\\\n| `klms-connection-1` | Connection 1/2: mTLS handshake with certificate validation (server chain + client cert) + OAuth2 bearer token |\\\n| `klms-connection-2` | Connection 2/2: seed → wrapper key (both sides, KDF) + AES-256-CBC container payload transport |\\\n\\\n\"],[0,\"### docs\"]],\"start1\":3269,\"start2\":3269,\"length1\":16,\"length2\":344},{\"diffs\":[[0,\"ams/KDF\\\n\"],[1,\"python scripts/render-puml.py docs/diagrams/Transport\\\n\"],[0,\"python s\"]],\"start1\":4452,\"start2\":4452,\"length1\":16,\"length2\":70}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-21T05:53:45.143Z
created_time: 2026-08-21T05:53:45.143Z
is_locked: 0
type_: 13